Use the system trust store for HTTPS requests

[zanieb]

Closes #1474

Using the rustls-tls-native-roots feature

rustls-tls: Enables TLS functionality provided by rustls. Equivalent to rustls-tls-webpki-roots.

rustls-tls-webpki-roots: Enables TLS functionality provided by rustls, while using root certificates from the webpki-roots crate.

rustls-tls-native-roots: Enables TLS functionality provided by rustls, while using root certificates from the rustls-native-certs crate.

Additional context:

• Can't use a self-signed certificate without using danger_accept_invalid_certs seanmonstar/reqwest#1554
• Drop certifi, use system trust store by default encode/httpx#302
• Should I use the native certs or webpki-roots?

Prior discussion at #609

[zanieb]

The major downsides are:

• The OS update system may, in fact, be quite poor at keeping the root certificates up-to-date if it is disabled or out-of-support.
• The quality of the ca-certificates package on debian-based Linux distributions is poor. At the time of writing, this ships many certificates not included in the Mozilla set, either because they failed an audit and were withdrawn or were removed for mississuance.

[BurntSushi]

Seems okay to me. In particular, it seems like this is the recommended approach from rustls.

[notatallshaw]

FYI, Pip is moving to this model via truststore: https://pip.pypa.io/en/stable/topics/https-certificates/

My experience is it is massively helpful in large organization environments.

[carlosjourdan]

Corporate network with ssl inspection firewall, custom ca on every site. Root certificate is trusted by windows, and environment variables REQUESTS_CA_BUNDLE and SSL_CERT_FILE are setup. Python requests work fine. Pip install as well. uv fails with error below.

error: error sending request for url (https://pypi.org/simple/zeep/): error trying to connect: invalid peer certificate: UnknownIssuer
  Caused by: error trying to connect: invalid peer certificate: UnknownIssuer
  Caused by: invalid peer certificate: UnknownIssuer

[zanieb]

Hi @carlosjourdan would you mind opening a new issue?

[carlosjourdan]

Just did